Violetlabs · Authentication Profile

Violetlabs Authentication

Authentication

Violet Labs exposes two authentication models. The REST Explore API uses an API-key credential passed in an HTTP header. The hosted MCP server (and the broader app.violetlabs.com surface) additionally supports OAuth 2.0 with PKCE and dynamic client registration. API keys are created in Company Settings and may be given an optional expiration date.

Violetlabs secures its APIs with apiKey and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

CompanyHardwareEngineeringManufacturingPLMERPData IntegrationRequirements ManagementAerospaceDefenseMCPSystems Engineering

Methods: apiKey, oauth2 Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in: header

Security Schemes

apiKeyAuth apiKey

· in: header ()

oauth2 oauth2

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: >-
  https://docs.violetlabs.com/features/api/generate-an-api-key,
  https://docs.violetlabs.com/features/api/endpoints,
  https://docs.violetlabs.com/ai/mcp, and the OAuth/OIDC discovery documents at
  https://app.violetlabs.com/.well-known/openid-configuration and
  /.well-known/oauth-authorization-server.
docs: https://docs.violetlabs.com/features/api/generate-an-api-key
description: >-
  Violet Labs exposes two authentication models. The REST Explore API uses an
  API-key credential passed in an HTTP header. The hosted MCP server (and the
  broader app.violetlabs.com surface) additionally supports OAuth 2.0 with PKCE
  and dynamic client registration. API keys are created in Company Settings and
  may be given an optional expiration date.
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken]
schemes:
- name: apiKeyAuth
  type: apiKey
  in: header
  parameter_name: x-api-key
  description: >-
    Tenant API key created in Company Settings > API Keys, passed on every REST
    request in the x-api-key header (the MCP server accepts the same key as
    X-API-Key). Keys can carry an optional expiration date.
  applies_to: Violet Explore API (POST /api/explore) and API-key MCP clients.
  docs: https://docs.violetlabs.com/features/api/generate-an-api-key
- name: oauth2
  type: oauth2
  description: >-
    OAuth 2.0 authorization server for the hosted MCP server. Users authenticate
    with existing Violet credentials and select a workspace. Supports PKCE
    (S256) and dynamic client registration (RFC 7591).
  authorizationUrl: https://app.violetlabs.com/api/oauth/authorize
  tokenUrl: https://app.violetlabs.com/api/oauth/token
  registrationUrl: https://app.violetlabs.com/api/oauth/register
  grant_types: [authorization_code, refresh_token, client_credentials]
  pkce: S256
  scopes:
    mcp: Access the Violet MCP server for the selected workspace.
  discovery: well-known/violetlabs-openid-configuration.json

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/violetlabs-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.